This vulnerability exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7. It is exploitable remotely over the network via HTTP by an attacker with low privileges and does not require user interaction. Successful exploitation can lead to unauthorized read and modification (update, insert, delete) of some accessible data within the affected Siebel CRM Cloud Applications. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and impacts on confidentiality and integrity but no availability impact. The Oracle advisory for the September 2026 Critical Security Patch Update includes patches addressing this vulnerability among 673 others across multiple Oracle products.

An attacker with network access and low privileges can exploit this vulnerability to gain unauthorized read access and unauthorized update, insert, or delete access to some data within Siebel CRM Cloud Applications. This compromises the confidentiality and integrity of the affected data. The vulnerability also has the potential to impact additional Oracle products due to scope change. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Siebel CRM Cloud Applications versions 22.3 through 26.7 are strongly advised to apply the relevant patches promptly to remediate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.